TI-2026-29581 Aliases CVE-2026-40927

Docmost: XSS in Comments with JavaScript URI

LOW 23CWE-79Published 2026-04-21 · Updated 2026-04-22

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.0, when leaving a comment on a page, it is possible to include a JavaScript URI as the link. When a user clicks on the link the JavaScript executes. This vulnerability is fixed in 0.80.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00139 3rd percentileScored 2026-11-07

Fix Fixed docmost (docmost): 0.80.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
docmost	docmost	before 0.80.0	0.80.0	Patch available	CNA

docmost Vendordocmost Affected before 0.80.0 Fixed in 0.80.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:docmost:docmost::::::::	before 0.80.0	Vulnerable	docmost

cpe:2.3:a:docmost:docmost:*:*:*:*:*:*:*:* Versions before 0.80.0 Vulnerable ·docmost

Remediation

Fix · CNA docmost (docmost) Fixed in 0.80.0

Timeline

2026-10-02 Threatist record created from CVE-2026-40927

References

Advisory 1

https://github.com/docmost/docmost/security/advisories/GHSA-4gv6-jw3v-wc34

TI-2026-17859 Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip) CVSS 3.1CRITICAL 9.8
TI-2026-19373 Docmost Affected by Stored XSS in Public Share Page CVSS 3.1HIGH 7.3
TI-2025-35043 Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code CVSS 3.1MEDIUM 6.1
TI-2026-19029 Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid rendering CVSS 4.0MEDIUM 6.3
TI-2026-26508 Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation CVSS 3.1MEDIUM 5.4
TI-2026-26507 Docmost page content has stored XSS via unsanitized attachment URLs CVSS 3.1MEDIUM 5.4

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences